Is it possible to (core-dump) recover a video in memory of the player (VLC) started without a debugger?

Question

Essentially, I'm wondering how difficult or possible it would be to do a core-dump on an already running process that was started without a debugger.

I have a video that I opened in VLC (and is still running in VLC). I accidentally, however, deleted the original file but to my surprise, was still able to scroll back and forth on in VLC (making me think it's still in memory).

Would it somehow be possible to do a core dump of the running process from it's PID and somehow piece together the data? Would that likely involve me following pointers through data-structures that I would need to sift through VLC's source code for?

I'm running OSX right now (so BSD). I think you could do a core-dump on processes with gdb if it was started alongside the debugger, but I'm not sure about trying to do it with processes already running (as I'm sure the OS would also not like that).

Any ideas?

I would add the tag "core-dump" but I don't have enough points.

Answer 1

Well since your VLC is still running the easiest to recover your file will be fire up "View" -> "Advanced controls" and re-record the entire file. You should find a vlc-record-... somewhere in your homefolder.

To answer your question, you can attach to a running process with attach <pid> in a gdb shell without argument(s).

Use detach to return execution to vlc.

memory can be dumped with dump binary memory result.bin start-addr end-addr (see http://sourceware.org/gdb/onlinedocs/gdb/Dump_002fRestore-Files.html) but it's highly unlikely your entire file will be in memory, it probably still works because the file descriptor is still open.

As a small disclaimer, you probably only got 1 shot at this. As soon as the file descriptor is closed (this will probably happen when VLC reaches end of file and gets into 'stopped' state or if the gdb does something unintended) your file will be lost - so you might want to try those steps first on a new / different file, preferably on a different Mac.